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SECURITY SYSTEM 


The present invention relates to a security system. Such a security system is particularly 
suited for use in cash in transit operations such as where cash is delivered to automatic 
teller machines. The system also comprises improvements to the security of automatic 
teller machines. 

Automatic teller machines (ATM) are now common. Each machine carries a number of 
removable cassettes in which money is stored. Stamps or tickets may be stored in similar 
types of machines. It is necessary, from time to time, to replenish the cassettes in the 
ATM. This is normally done at fixed intervals based on the expected usage of the 
machine. A security vehicle and guards is despatched from a central location to take full 
cassettes to an ATM. The cassettes may typically contain £200,000 and consequently 
theft of one or more cassettes represents a relatively easy way of obtaining a significant 
amount of money for a criminal. Furthermore, when a new cassette is installed in a 
machine, a "empty" cassette is removed from the machine. However, since the 
replenishment is done at predetermined intervals, rather than when the cassettes are low 
or empty, the "empty" cassettes may infact contain a considerable amount of cash. Some 
£3.5 million was lost in 1995 in the UK alone through robberies on ATM machines when 
money was being transferred. 

According to a first aspect of the present invention, there is provided a security unit 
comprising locking means for locking the security unit onto a container to be protected, 
spoiling means for spoiling the contents of the container in the event of an attack and 
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control means for controlling operation of the locking means and spoiling means. 

It is thus possible to provide a security unit which can lock onto a automatic teller cash 
cassette, or onto a cash cassette used for cash deliveries in general 

Advantageously, the locking means locks around an opening of the cassette. 
Alternatively the locking means may engage with an adaptor mounted on a side of the 
cassette. 

The security unit may comprise a first module containing the control system thereof, and 
a second module containing the locking mechanism. The first and second modules are 
advantageously detachable from one another. The spoiling means may be included 
within one of the first and second modulates, for example the first module. Additionally 
or alternatively spoiling means may be included within the container protected. 

Preferably the control module includes communication means for exchanging data with 
other security devices. Advantageously the control module also includes a local memory 
and local power supply in order that it can function for a predetermined time without 
external electrical connection. The control module may also include a data processor 
and one or more sensors, such as motion sensors. 

Advantageously, in use, the local memory is programmed with the identity of the or 
each automatic teller machine which is scheduled for a cash delivery within a 
predetermined time period, for example during a working day. The control unit may 


also include data concerning the expected time of delivery and data concerning the 
identity of other security systems associated with the ATM machines. Alternatively this 
data can be provided in respect of one delivery at a time by a controller in a delivery 
vehicle. Thus, as the security unit is removed from a cash in transit vehicle, the control 
unit may interface with a security system of the cash-in-transit vehicle to obtain an 
estimate of the vehicle's position and identity of the ATM to which a delivery is being 
made to. As the guard carries the cassette and security unit towards the ATM, the 
security unit may be arranged to establish a bi-directional communication link with the 
ATM in order that the security unit and the ATM can verify the identity of each other. 
Failure to obtain a valid identity within a predetermined period of time may be taken as 
an indication that a breach of security has been occurred and may cause the spoiling 
mechanism to be activated. 

The ATM may be arranged, upon identification upon the expected security unit, to 
release some of its own security measures, such as unlocking a safe in which an ATM 
is normally located. 



The control unit may also be arranged to interface with bank door locks or other security 
systems along it route from the cash-in-transit vehicle to the ATM in order to validate 
that the delivery is going to plan. 

The control unit of the security unit may also measure parameters such as walk time, ie 
the time which it believes it is being carried by the guard, or absolute time and if either 
of these exceeds an associated threshold time, a security breach may be identified and 
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the spoiling mechanism activated. 


The security unit may also include accelerometers, compasses and/or inertial guidance 
systems. These may be used to determine if the security unit is being carried in an 
inappropriate direction. Furthermore, the characteristic walk of a security guard may be 
learned over a period of time and this may be compared with the motion of the person 
carrying the security unit and cash cassette during a delivery in order to determine that 
the cash is being carried by an authorised person. 

The security unit may include other environmental sensors, such as a temperature sensor. 
The temperature and/or rate of change of temperature may be monitored to determine if 
an attack is being made. It is known that oxyacetylene torches have been used in an 
attempt to cut off security units. Furthermore, some attempts have been made to defeat 
electronic based security systems by immersing the electronics in liquid nitrogen. Both 
of these techniques will involve a rapid rate of change of temperature which may be 
detected in order to activate the spoiling means. However, the rate of change of 
temperature may also be compared with actual temperature in order to inhibit operation 
of the spoiling means until the temperature falls outside of an expected range. Rapid 
changes in temperature may occur, for example, when a delivery is made from a security 
van operating in winter. Thus a very rapid change of temperature may be observed when 
the security unit is removed from the van. 

The spoiling mechanism may include a dye pack for delivering the dye. The delivery 
means may comprise a gas cylinder, use of a chemical delivery system in order to 


generate gas to force the dye to be expelled, an explosive delivery system or a 
mechanical delivery system, for example in the form of a compression spring held in a 
compressed state until deployment is required. 

Preferably the mechanical locking is provided by an interface element. 

Alternatively , the spoiling mechanism may include some other spoiling mechanism, such 
as a pyrotechnic smoke and/or dye device. 

According to a second aspect of the present invention, there is provided a security 
container comprising: 

1. An enclosure for defining a protected volume, said enclosure having an opening; 

2. A removable closure for sealing the opening in the enclosure; and 

3. A protective element protecting the removable closure from attack and arranged, 
in use, to act as a sacrificial element in the event of an attack on the security 
container in order to enable a spoiling apparatus located in one of the enclosure, 
the removable closure or the protective element to operate. 

Preferably the removable closure is formed by an interface element. 

Preferably the interface element is arranged to selectively lock to one or more of the 
following: 


1. 


A container; 


2. 


The enclosure; 


3. 


The protective element; 


and 
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An external locking apparatus. 


Preferably the container is the cash cassette of the ATM, the cassette is placed inside the 
enclosure, and the interface element locks to the cash cassette and the enclosure. 

The protective element may be in the form of a hood which, in use, covers the interface 
card and extends someway along the length of the enclosure. The interface card is also 
arranged to lock to the hood. It has been known for a guard to be attacked and the ATM 
cassette and an associated spoiling system to be removed from the guard. Thieves have 
then used a sledgehammer to knock the spoiling system from the cassette. If performed 
correctly, the spoiling system can be sheared away from the cassette before the spoiling 
system has had ample opportunity to spoil the contents. The provision of a sacrificial 
element, for example in the form of a casing or hood, means that such impulsive blows 
result in the deformation of the sacrificial element, whilst leaving the spoiling system 
intact for long enough to operate. 

Preferably the enclosure and/or the protective element, ie hood, includes means for 
detecting physical penetration thereof. The penetration detecting means may include one 
or more conductors arranged, for example, such that one or more of them is broken by 
the formation of an aperture in the material of the enclosure or protective element. The 
conductors may be arranged in a serpentine or a helical manner. Additionally or 


alternatively, other physical parameters such as change in conductivity, change in 
capacitance, pressure or optical propagation may also be utilised. 

According to the third aspect of the present invention, there is provided a removable 
closure for a security container, the closure comprising locking means for locking to at 
least one of the following: 

1. A container which encloses a volume to be protected; 

2. An enclosure for protecting a volume to be protected, which volume may enclose 
the container mentioned herein above; 

3. A protective cover; and 

4. An external locking apparatus. 

Advantageously such a locking means is provided as an interface card carrying a plurality 
of movable engagement elements moveable between locking and unlocking positions. 
Preferably the engagement elements are slidable bolts. The bolts may be individually 
controllable or they may be constrained to operate in a predetermined sequence. The 
engagement elements may be controlled by associated actuators, for example solenoids. 
However, in a preferred embodiment the operation of the engagement elements are 
controlled by respective cams mounted for rotation in response to rotation of a common 
shaft. Advantageously, the cams are mounted for rotation about a common axis. 

Preferably the locking mechanism follows a set sequence and in turns locks onto other 
parts of the system as follows: 


Position 1. 
Position 2. 
Position 3. 
Position 4. 
Position 5. 
vehicle; 
Position 6. 


All rods withdrawn; 

Locks onto a control unit only; 

Locks onto the control unit and cassette; 

Locks onto the control unit, cassette and sleeve; 

Locks onto the control unit, cassette, sleeve and rack of a cash-in-transit 
Locks onto the cassette, sleeve and rack of the cash in transit vehicle. 


The interface card is arranged that it can only proceed from one position to an adjacent 
position at a time. Advantageously the protective element, for example the sacrificial 
hood, is also locked onto the locking mechanism at the position 2, 3, 4 and 5. 


Advantageously the control unit includes means for driving the interface card between 
it's various operating positions. The control unit may also include the spoiling means and 
it's activation system. The control means may be held within the protective element. 

Preferably the shaft is an input shaft of the interface card and is protected from malicious 
or inadvertent rotation by an electromechanical interlock. Preferably the interlock is in 
the form of a solenoid which must be actuated to release the input shaft in order to allow 
it to rotate. 


Advantageously solenoid is powered by an inductive coupling. Thus there is no visually 
apparent means of supplying power to the solenoid, and indeed the solenoid is itself not 
visible from casual inspection of the interface card. 
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Alternatively, the shaft may be connected to or be part of an electric motor which may 
be wholly or partially implemented within the interface card. Where the motor is wholly 
implemented within the interface card, it may receive power from the control unit via an 
inductive coupling or by direct connection utilising contacts on the surface of the 
interface card. The interface card may also contain a motor controller which requires an 
identity code to be presented to it before it enables the motor. Where the motor is only 
partially implemented within the interface card, the rotor and rotor magnets may, for 
example, be inside the interface card whereas the stator coils may be in the control unit. 

According to a fourth aspect of the present invention, there is provided a security unit 
for use inside an automatic teller machine, the security unit comprising attachment means 
for attaching the unit to an ATM cash cassette, spoiling means for spoiling the contents 
of the cassette, and control means. 

Advantageously the control means is arranged to establish communication with the ATM 
in order that an attack on the ATM may be signalled to the security unit in order that it 
operates the spoiling means to spoil the contents of the cassette. 

Preferably the security unit is arranged to signal to the ATM when it has correctly 
coupled to the cassette and has taken over responsibility for protecting the money within 
the cassette. Advantageously a security unit used to protect the money during transport 
to the ATM will not disengage from the cassette until such time as the ATM based 
security system has confirmed that it is now responsible for security. 


Preferably the ATM based security system comprises a reservoir or ink which can be 
ejected under pressure via a coupling unit into the cassette to degrade the contents 
thereof. The reservoir and control electronics of the ATM based security system may be 
contained within an enclosure containing penetration detection means, for example of the 
type herein before described, in order to prevent the electronics from being tampered 
with. 

According to a fifth aspect of the present invention, there is provided a tamper resistant 
coupling for coupling a ink or dye based security spoiling system to a security container, 
the coupling comprising co-operating male and female connectors, in which the male 
connector comprises a hollow pipe disposed within a relatively moveable sheath, the 
pipe including at least one delivery aperture arranged to one side thereof, such that as the 
male and female components are coupled together, the pipe extends into a recess in the 
female component and the end of the pipe extends past the or at least one delivery 
aperture in the female component. 

It is thus possible to provide a coupling arrangement in which the male component is 
able to push debris past a delivery aperture in the female component, thus attempts to 
defeat the security system by placing chewing gum or the like in the dye delivery path 
are defeated. 

Preferably a coupling monitoring device is arranged to monitor the relative motion 
between the sheath and the pipe of the male unit and to signal an error if the relative 
motion falls outside an expected range. Thus the coupling monitoring device is able to 
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detect when the coupling is not properly coupled and to send a signal to the ATM 
security system, which in turn inhibits the security system used in transit of the cash from 
releasing from the cassette. 

Advantageously, once the male and female units are properly coupled, a latch is operated 
to secure the units in place. 

According to sixth aspect of the present invention, there is provided a rack system for 
use in a cash in transit vehicle, the rack containing a plurality of attachment points for 
attaching a cassette and interface card to the rack, and a control system for controlling 
spoiling means for spoiling the contents of the cassette, wherein the spoiling means may 
be provided within the rack or may be attached to or provided in the individual interface 
cards. 

Advantageously the rack comprises a plurality of arms moveable between operating and 
non-operating positions. In the operating position, the arms are arranged to engage with 
and secure onto a cash cassette, whereas in the non-operating positions, the arms are 
folded away such that the vehicle may be used to carry other items. 

Advantageously the rack includes a data communications link such that the security 
system used with the cassette while it is being carried can exchange data with the cash- 
in-transit vehicle in order to determine the position of the vehicle or other information 
such as the identity of the ATM machine which is to be filled. 


11 



It is advantageous for a dummy run to be made between the cash in transit vehicle and 
the ATM machine in order to ensure that the route is clear for use. The vehicle security 
system may be arranged to only release one in transit security system and a dummy 
container when the vehicle arrives at the unloading point. The security system used on 
the dummy run may interface with the ATM in order to verify its identity and may relay 
this information back to the vehicle security system when the dummy run is completed. 
The vehicle security system may be arranged to inhibit release of the cassettes until such 
time as the dummy run has been completed and the identity of the ATM to be loaded has 
been confirmed to the vehicle's security system. Furthermore, the in-transit security 
system used in the dummy run may compare the time of the dummy run with an 
expected time and only assert that the dummy run was made without incident if the 
actual time and expected time are within a predetermined time range of one another. 
Alternatively, the time of the dummy run may be used to vary the time allotted to the 
actual delivery. This enables the walk time to be corrected in the event that the delivery 
vehicle has to park at a different position than expected, for example due to a change in 
parking restrictions or other traffic. 

According to a seventh aspect of the present invention, there is provided an ATM 
machine arranged to exchange data with the security systems herein before described. 

According to an eighth aspect of the present invention, there is provided a marker for use 
in a spoiling apparatus, the marker comprising an ink or dye having or including an 
additive that emits visible radiation. 
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Preferably the ink, dye or additive is arranged to Phosphoresce or fluoresced Suitable 
compounds exhibiting these properties are well known. Such a dye has the advantage 
that even if someone who touched the contents of the protected area, ie the cash cassette, 
after the spoiling mechanism had been operated, managed to wash the visible components 
from their hand, the fluorescing component may still remain on their skin and be revealed 
by illumination with ultra-violet light. 

According to a ninth aspect of the present invention, there is provided an apparatus for 
activating a spoiling mechanism, comprising a first coil connected to energise the spoiling 
mechanism, the first coil being mounted on a first member and a second coil connected 
to a power supply and mounted on a second member, in which the first and second 
members are arranged such that relative motion between them causes the coils to 
approach and inductively couple one another, thereby supplying power to the spoiling 
mechanism. 

According to a tenth aspect of the present invention, there is provided a method of 
manufacturing tamper resistant panels or containers, comprising of: 

1. Laying down a first layer of fibres; 

2. Laying down an array of sensing elements; 

3. Laying down a second layer of fibres; 

4. Optionally placing the layers into a mould; 

5. Impregnating the layers with resin and allowing the resin to harden. 
Advantageously the sensing elements are conductive. 
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According to an eleventh aspect of the. present invention, there is provided a method of 
protecting the contents of an ATM while the ATM is being serviced or repaired 
comprising the steps of securing the cash cassettes of an ATM to a security system 
according to the first or second aspect of the present invention, and removing the cash 
cassettes whilst the machine is being serviced or repaired. 

The present invention will further be described, by way of example, with reference to the 
accompanying drawings, in which: 

Figure 1 schematically illustrates a security container constituting an embodiment of the 
first, second and third aspects of the present invention; 

Figure 2 schematically illustrates the sacrificial hood in greater detail; 

Figure 3 is a schematic view of an interface card; 

Figure 4 illustrates an interface card at its birth position; 

Figure 5 illustrates the interface card of Figure 4 at a position where it locks onto a hood; 

Figure 6 illustrates the position of an interface card for locking onto the hood and cash 
cassette; 

Figure 7 illustrates the card at a position for locking onto the hood, cassette and the 
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sleeve; 


Figure 8 illustrates the interface card at a position for locking onto the hood, cassette, 
sleeve and rack of a cash-in-transit vehicle; 

Figure 9 illustrates the interface card at a position where it locks onto the cassette, sleeve 
and rack of the cash-in-transit vehicle, but has released the hood; 

Figure 10 schematically illustrates an example of an dye injection unit for use with an 
ATM cassette while it is loaded inside the ATM; 

Figure 11 illustrates the dye injection components shown in Figure 10 at an engaged 
position; 

Figures 12a and 12b schematically illustrate the operation of a mechanically powered dye 
injection system; and 

Figure 13 schematically illustrates a sleeve security system whereby removal of the 
sleeve when the system is active cause the dye injection system to become activated via 
an inductive coupling. 

Figure 1 schematically shows a cash-in-transit security container in cross section. The 
container, generally indicated as 2, provides protection against theft while the cash is 
being carried from a delivery vehicle to an automatic teller machine. This has 
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traditionally been the weakest point in a security system, since the guarcl may be 
physically attacked in order to render him incapable, and then the security container may 
be removed from the guard. An ATM cash cassette 4 is locked to an interface card 6 
which contains a plurality of locking components in order to enable it to lock to various 
other components of the system. A hood 8 is also locked to the interface card 6 and 
carries in an internal module 10 which incorporates a spoiling apparatus and processing 
electronics. An enclosure (also referred to herein as a sleeve) 12 surrounds the cash 
cassette 4 and extends within a lower lip of the hood 8, thereby completely enclosing the 
cash cassette 4 and the interface card 6. The hood 8 and the enclosure 12 are each 
manufactured so as to include a plurality, typically two, elongate conductive elements 
which repeatedly traverse the surface of the hood and container in order that a breach in 
the walls of the hood or container will cause the conductive elements to be broken. This 
loss of conductivity can be used by the processing electronics within the module 10 as 
an indication that an attack upon the cash carrying container 2 is in progress. 

Figure 2 schematically illustrates the hood 8 in more detail. The hood 8 is of a unitary 
moulded construction and it contains an internal recess 20 in which the control 
electronics and spoiling mechanism are housed. The lower peripheral edge 22 of the 
hood 8 comprises a downwardly depending flange 24 which, in use, extends over the top 
of the sleeve 12, together with an internal recess 26 into which the uppermost portion of 
the sleeve 12 sits. Such an arrangement inhibits relative motion between the hood 8 and 
the sleeve 12. The hood also has an integrally moulded carrying handle 28. The inner 
surface of the hood 8 has a plurality of recesses which, in use, engage with reciprocating 
bolts of the interface card. 
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Figures 3 to 9 illustrate an interface card and the operation thereof. The interface card 
30 illustrated in Figure 3 is shown in a simplified form. The interface card comprises 
a base plate 32 which carries first and second gear wheels 34 and 36 in toothed 
engagement with a gear 38 held on an input shaft 40. Each of the gears 34 and 36 
carries a plurality of camming surfaces. The camming surfaces may be vertically spaced 
from one another and/or may comprise one or more grooves formed in the respective 
cogs, or camming members attached thereto. Cam followers engage with the camming 
surfaces and the motion of the cam followers is transmitted via rods to cause 
displacement of locking pins, and will now be described in greater detail. The interface 
card 30 is provided with side walls and upper and lower plates so that the operating 
mechanism is protected and concealed from view. 

Figure 4 shows the interface card in greater detail and also shows the outline of hidden 
elements. The card is symmetrical about the line A- A, and for simplicity only one half 
of the card will be described. The gear wheel 34 carries first to fourth spaced camming 
surfaces 50, 52, 54 and 56, respectively. The first and second camming surfaces form 
the sides of a groove 53. A first cam follower 60 engages camming surfaces 50 and 52 
and also extends through aligned slots centrally disposed in a pair of pivotally mounted 
arms 62 and 64, the free ends of which engage with laterally extending projections of 
first and second slidable bolts 66 and 68, respectively. Rotation of the camming surfaces 
with the wheel 34 causes the bolts 66 and 68 to be extended or retracted from a 
downwardly depending base unit of the interface card so as to engage or disengage with 
attachment regions of a cash cassette. 
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Similarly, the cam followers 70 engaging respective ones of camming surfaces 54 and 
56 (which are mirror images of each other). The camming surfaces 54 and 56 are 
vertically separated from one another (assuming the plane of Figure 4 to be horizontal). 
The cam followers 70 are disposed midway along associated levers 72. Each lever 72 
is pivoted at one end and has a free end which includes a notch for engaging a projecting 
pin of an associated bolt 74. Similarly, a further cam follower 80 is connected to a 
pivoted arm 82. The arm 82 is pivoted at a pivot point 84 at one end thereof, and has 
tines 86 formed at the other end thereof for engaging a pin of a reciprocating bolt 88. 
A similarly arranged pivoted arm 90 has an upstanding pin 92 which engages in a 
elongate slot 94 of the arm 82 such that motion of the arm 82 is transferred to the arm 
90 to operate an associated bolt. 

Starting from a position shown in figure 5, the operation of the interface card will now 
be described. Initially, the hood 8 containing the control for the interface card, including 
an electric motor (not shown) is placed over the interface card such that the motor in the 
hood engages with the input shaft 40 of the interface card. The interface card may 
include a solenoid 100 which is coupled to an induction coil 102. The hood 8 contains 
a similarly disposed induction coil and when the hood is correctly positioned, the 
induction coil therein couples with the coil 102 to energise the solenoid 100 thereby 
retracting a locking element from engagement with the gear 38. The input shaft is then 
rotated to extend the locking pins 74 such they engage in the recesses of the hood 8 and 
lock the hood to the interface card 6, as shown in Figure 5. 

The combined hood and interface card unit is then presented to a cash cassette 4. Once 


18 



the cash cassette 4. is correctly positioned with respect to the interface card 6* the hood 
operates the drive motor so as to extend the pins 66 and 68, thereby locking the cash 
cassette onto the interface card. Next the sleeve 12 is brought into abutment with the 
hood 8 such that the cash cassette 4 is completely enclosed between the sleeve 12 and 
the hood 8. Once this has been achieved, the control electronics energises the motor 
again so as to drive the interface card to the position shown in Figure 7 at which the 
bolts 88 are extended thereby locking the sleeve 12 to the interface card. As shown in 
Figure 8, the interface card can be driven to a further position at which the bolts 88 
extend further from the interface card 6 at this position, the bolts 88 protrude from the 
enclosure and can engage with locking recesses in a cash-in-transit vehicle storage rack. 
Finally, the interface card can be driven to the position shown in Figure 9 at which the 
bolts 88 remain extended to engage in the storage rack but the bolts 74 have retracted in 
order to enable the hood 8 to be released. This final position corresponds to the mode 
for transport of cash within the cash-in-transit vehicle. 

The rack of the cash-in-transit vehicle contains a spoiling apparatus for each cash 
cassette. 

The operational cycle for such a system is typically as follows. A cash in transit vehicle 
arrives at a cash centre where the ATM cassettes are loaded. The vehicle will typically 
include 25 to 40 sleeves 12 located on arms of a security rack. Each sleeve 12 is kept 
with an interface card which is locked onto both the sleeve 12 and the rack, thus the 
interface card is at the positioned illustrated in Figure 9. A number of hoods, typically 
three (two operational hoods and one spare) are located on base stations which charge 
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the batteries of the hoods and provide communication between the hoods and the rack 
controller. In order to load the vehicle, a hood is removed from its base station and 
presented to a sleeve/interface card in the rack. The rack arm communicates with the 
hood via a secure encrypted infrared communications link (seirc). As the sleeve is 
empty, the hood is authorised by the vehicle security system to operate the interface card 
firstly to move it to the position shown in Figure 8 such that the hood becomes locked 
to the interface card, and then onto the position shown in Figure 7 such that the hood and 
sleeve combination is released from the rack, the hood now has control of the in-transit 
cash container 2. 

The sleeve 12, interface card 6 and hood as a combined unit are carried into the cash 
centre where a seirc link is provided between a control system and the hood. The control 
system down loads details of the destination, contents and, optionally, other information 
of each cassette. The cassette may be identified by a serial number and/or bar code. 
Once these details are transferred to the hood, the hood is authorised to operate the 
interface card so as to release the sleeve 12 and then to move to a position (Figure 5) 
where it is ready to lock onto the cash cassette. The hood/interface card is then 
presented to the cassette and the hood moves the interface card to the position shown in 
Figure 6. The cassette is then inserted into the sleeve 12 and the hood moves the 
interface card to the position as shown in figure 7 so as to lock onto the sleeve. 

The combined unit is then carried onto the vehicle and is inserted into one of the empty 
rack arms. The hood and rack communicate by the seirc and the hood passes the 
cassette details to the rack arm and security system controller. The controller authorises 
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the hood to move the interface card to the position shown in Figure 8 so as to lock the 
interface card to the rack. Once the rack arm has confirmed that locking has been 
achieved, the hood is then authorised to move the interface card to the position as shown 
in Figure 9 so as to release the hood. The hood is then used to load the rest of the 
cassettes. 

The cassettes are protected on the vehicle in a number of ways. Each cassette is fully 
enclosed by a sleeve/interface card which both contain continuous electrical circuits 
which are monitored by the rack. Loss of these circuits is interpreted as a physical attack 
on the system and the degradation system in the rack arm will then be actuated to spoil 
the contents. 

An attempt to remove the cassette/sleeve/interface card unit forcibly from the rack arm 
will be detected by the rack arm which will cause spoiling of the contents. 

An attack on the rack arm itself will also be interpreted as an attack and will cause the 
spoiling system to be activated. 

The rack as a whole is authorised to allow only a preset number of cassettes to be 
removed at once, typically two. The number of removed cassettes is continuously 
monitored and a violation of this parameter, preferably after a suitable warning, results 
in the initiation of the degradation systems in some or all the rack arms. Such selection 
may be based on the contents of the cassettes. 

When the vehicle reaches a drop off destination, this fact is communicated to the hoods. 
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The information may be communicated in a number of ways and may include 
confirmatory information obtained by positioning devices such as GPS. Furthermore the 
hood is passed information by the rack appertaining to the drop off site. The information 
may include encrypted access control data and identification data such that the hood may 
establish a communications link with the ATM in order to confirm that the correct 
cassette is to be loaded into the correct machine. 

It is usual for deliveries to be carried out by two guards because of the risk of attack at 
the point of replenishment. Furthermore, it is also required that the route to the ATM 
be checked out by doing a dummy run before the cassettes are taken across the 
pavement. For commercial reasons, the security procedures are often breached. 
However, the system has the opportunity to force that these procedures take place. 
Furthermore, since the cash is transported in a secure environment, the number of guards 
may be reduced. Once the vehicle has arrived, the vehicle's security system only 
authorises a hood to mate with an empty sleeve. This is then carried by the guard from 
the vehicle to the ATM. The hood monitors the amount of movement (walk time) 
between the vehicle and its destination. This information may then be uploaded to the 
security system of the vehicle in order that it can be communicated to the or each other 
hood. 

Replenishment may be made outside normal operating hours. In order to avoid use of 
keys, an option to the system is for the hood to communicate with a sensor located 
adjacent the door of the bank such that the door is unlocked upon delivery of the cash. 
Furthermore, the safe surrounding the ATM, and the ATM itself may also communicate 
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with the hood in order to release their various locking mechanisms. As part of this 
information transfer, the hood may gain information verifying that it has been taken to 
the correct destination. This overcomes an attack strategy of taking the vehicle to a 
hidden location and inputting data to the system to indicate that it has actually arrived 
at its delivery point. It also prevents mistakes being made by the guard inputting the 
wrong location information. 

In such a system as described herein above, once the guard has input the necessary 
location information (and any further data that is required), the hood is locked onto an 
empty sleeve/interface card unit. Once locking has been achieved, the hood/sleeve 
combination is released from the rack and is then taken to the bank, where the hood 
communicates with the community systems in order to gain access to the ATM. 
Eventually, the hood communicates with the ATM and any security systems contained 
therein, such as an ATM based cash spoiling system as will be described hereinafter. 
The security systems negotiate to enable the hood to be attached to the cassette, and once 
attachment is confirmed responsibility is passed from the ATM to the hood. The cassette 
is then released and can be withdrawn by the hood. A limited time, typically 20 seconds, 
is then allowed for the cassette to be inserted into an empty sleeve 12. The hood then 
moves the interface card to a position so as to lock onto the sleeve and the 
sleeve/cassette/interface card/hood is then carried back to the vehicle where it can be 
locked onto the rack. The removal of the first cassette from the ATM may be performed 
separately or as part of the dummy run. Further runs can then be made to replenish the 
cassettes of the ATM and remove the spent ones. 
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The hood may pass information to the ATM concerning the amount and denomination 
of notes held in the cassette. Thus the ATM can keep a running total of the amount of 
cash contained in it and may use this to assert a signal to a control centre to request 
replenishment when it begins to run unacceptably low on money. 

In order to provide continual security for the cash once the cash cassettes are loaded into 
the ATM, the cassettes are modified in order to provide an ink flow passage such that 
ink from the exterior of the cassette can be injected into the cassette and applied to the 
cash therein in order to spoil it. The cassette co-operates with a ATM based security 
system which comprises an ink reservoir, means for delivering the ink, and a control 
system. The ink reservoir and control system are housed within a container which 
advantageously has a construction similar to the sleeve 12 in that it contains embedded 
conductors such that an attack on the enclosure can be detected. The control electronics 
may also communicate with the ATM via an infrared link such that an attack on either 
unit may be signalled to the other and the spoiling systems initiated in each and every 
cash cassette. It is important to ensure that the ink delivery to the cassette cannot be 
defeated by tampering. Figures 10 and 1 1 schematically illustrate an ink delivery system 
which is tamper resistant. The ink delivery system comprises co-operating male and 
female parts indicated generally as 100 and 102. The female part 102 is, in the 
embodiment illustrated, attached to the ATM cassette. Advantageously the female part 
is in spring loaded attachment such that it can move between the positions illustrated 
generally as 103 and 104 in Figure 10 in order to accommodate tolerances in components 
and also to enable the same delivery route to be used when the cassette is in the ATM 
and also when the cassette is being carried in the security transit container illustrated in 
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Figure 1. 


As shown, a generally rectangular casing 110 has a tapered inlet 112 formed therein. 
The inlet 112 may have a generally conical profile which then merges with a cylindrical 
bore 114. The bore 114 is a blind bore, but has a ink delivery outlet 116 formed in a 
side wall thereof adjacent, but not at, the end of the bore 114. Only one delivery outlet 
is illustrated for simplicity, but a plurality of delivery outlets may be provided. They 
may be longitudinally and/or radially disposed with respect to each other. The ink 
delivery outlet is in fluid flow communication with a flexible pipe 118 which extends 
into the interior of the cash cassette. The casing 110 also incorporates a guide pin or 
other suitable locking elements which provides a point of attachment to a locking device, 
for example in the form of an arm, carried on the male part 100. The use of multiple 
delivery outlets enables the ink to be delivered more rapidly. 

The ink injection unit comprises a gas canister 130 coupled to an ink reservoir 132 via 
a throttling orifice 134. The gas canister is opened via a pyrotechnic device (not shown) 
which is actuated to rupture a seal of the canister 130. The interior of the ink reservoir 
132 is in fluid flow connection with a delivery passage 136 which forms a central 
delivery pipe 138 of the male member 100. The delivery pipe 138 opens at a sideways 
facing aperture 140 which, in use, aligns with the ink outlet passage 116 when the male 
and female elements are correctly coupled together. A sleeve 150 extends around the 
delivery pipe 138. The sleeve 150 is slidable with respect to the delivery pipe between 
a first position, as illustrated in Figure 10, in which the sleeve extends over the outlet 
140, and a second position (Figure' 11) in which the sleeve slides to the right as shown 
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in Figure 10 in order to expose the delivery outlet 140. The sleeve is urged to first 
position by a compression spring 152. 

In use, the male part 100 is attached to an automatic teller machine and positioned such 
that it engages with the female part 102 carried on a cash cassette when the cash cassette 
is at its operating position. As the cash cassette is loaded, the casing 110 is moved 
towards the male part 100 and the sleeve 150 engages with the conical recess 112 and 
is pushed against the urging of the compression spring 150 to uncover the aperture 140. 
This relative motion also ensures than any debris in the aperture 1 12 is pushed past the 
outlet pipe 116 thereby ensuring that debris cannot be deliberately introduced into the 
aperture 112 in order to defeat the security systems. A position sensor (not shown) 
monitors the relative motion of the sleeve 150 with respect to the remainder of the male 
unit to ensure that it reaches the correct position. Additionally, a latching arm (not 
shown) extends from the male unit towards a matching element on the female unit. The 
latching arm can only engage if the male and female units are correctly positioned with 
respect to one another. The position of the latching arm and also of the sleeve 150 is 
monitored by a controller (not shown) and only when these are at their correct position 
does the controller acknowledge that the security system is operable. 

Figure 11 shows the details of the coupling between the male and female unit when 
properly coupled in greater detail. 

Other ink release schemes may also be used as an alternative to use of compressed gas 
in a cylinder. Figures 12a and 12b "schematically illustrate a mechanically based scheme 
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in which an enclosure 160 contains a plate 162 which is held adjacent a wall 164 of the 
enclosure by a mechanical lock mechanism 166. Compression springs 168 act around 
the periphery of the plate 162 in order to urge it away from the wall 164. A flexible 
reservoir 170 of ink is positioned in the enclosure 160 such that it becomes compressed 
by the action of the plate 162 and springs 168 when the mechanical lock mechanism 166 
is released. A needle 172 extends into the container 160 and is positioned such that the 
ink reservoir is compressed against the needle 172 when the lock mechanism 166 is 
released, thereby causing the needle 172 to puncture the flexible reservoir 170 and to 
provide an escape route from the ink reservoir. 

The ink may contain additives, or itself be selected, such that it exhibits optical properties 
such as absorption or reflection outside of the visible range of light such that it can be 
detected by automated security systems. Additionally or alternatively the ink may 
fluoresce or phosphoresce. 

In addition to the security system described herein above it may be advantageous to also 
include a simple relative motion based system whereby movement of one item, for 
example an ATM cassette, with respect to another item, for example a sleeve, causes a 
spoiling system to be deployed. Figure 13 schematically illustrates such a system. 
Figure 13 schematically illustrates a sleeve 180 carrying a first induction coil 182, and 
cassette 184 carrying a second induction coil 186. The induction coil 186 is connected 
to a spoiling mechanism. The induction coil 182 is connected to a security system, and 
is energised, for example with alternating current when the security system is operative. 
If an attempt is made to remove- the cassette 184 from the sleeve 180, the second 
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induction coil 186 slides towards and eventually becomes aligned with the first induction 
coil 182. This enables the coils to inductively couple, thereby providing power to the 
degradation/spoiling mechanism contained within the cassette 184 which then activates. 

It is thus possible to provide a security system suited for use in cash-in-transit and ATM 
operations. Furthermore, such a security system also simplifies maintenance of an 
automatic teller machine. Hitherto, it has been necessary to arrange for security guards 
and a cash-in-transit vehicle to come and collect the cassettes from an ATM before it can 
be serviced since opening the safe of the ATM in order to service it has posed a security 
risk. However, with the use of a dye based spoiling system as part of the ATM, cassettes 
may remain in the ATM and be protected by the security system during servicing. In the 
event that it is necessary to remove a cassette, the cassette may be placed in a sleeve and 
hood combination as described herein before. Such a hood may be a service hood 
specially programmed to allow only a very minimal walk time in order to ensure that the 
cassette cannot be moved far from the ATM, or may include a proximity based 
communication system to the ATM again to ensure that the cassette cannot be removed 
far from the ATM without triggering the spoiling mechanism. 

Furthermore, the enhanced security systems provided within an ATM may enable the 
heavy steel safe that normally surrounds an ATM to be replaced by a lighter safe made 
of similar materials to the sleeve 6 and herein before described. 
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